The PARANOID Newsletter 


Because they ARE out to get you. 


A good walker leaves no tracks; 
A good speaker makes no slips; 
A good reckoner needs no tally. 
A good door needs no lock, 
Yet no one can open it. 
This is called "following the light. 
-Tao Te Ching 


Introduction 

This is the ninth issue of the PARANOID newsletter. This newsletter is for the person who takes their privacy 
VERY seriously. Lets face it, America is a POLICE STATE. Anything the government doesn't like 1s now 
considered terrorism. What would our founding fathers say if they were alive today! 


Destructive entry (or forced entry) is a non-covert method of entry characterized by damage to or 
destruction of a lock, safe, or surrounding objects, such as a door, window, or wall. It is by far the most common 
method of entry and is frequently used by law enforcement and military personnel for rapid entry to a residence or 
facility. As you might have guessed, there are many ways to destroy things. Techniques are classified by their 
method of destruction in terms of the physics of the operation but often overlap and complement one another. All 
destructive techniques use energy or force to damage, displace, weaken, or destroy components. Once components 
of a lock, safe, door, window, or wall lose structural or molecular integrity their ability to resist compromise is 
considerably reduced. The general categories of destructive entry are: chemicals, compression, impact, shearing, 
temperature, tension, and torsion. 


While the techniques discussed might seem advanced, the majority are rather stmple when put in 
perspective; doors are kicked in, padlock shackles are cut, locks are drilled, et cetera. Techniques are categorized to 
help the investigator identify, define, and study new attacks. While tool designs differ greatly the tool marks and 
forensic evidence they leave behind may help investigators quickly identify the techniques used to gain entry. 


Destructive Entry Principles 


Chemicals are used to affect the molecular structure of components. Chemicals, namely acids, can corrode, 
disintegrate, or dissolve components. Like temperature, chemicals often leave components vulnerable to other 
attacks. 


Compression is the use of pressure against a component 1n complementary directions. Essentially, the 
opposite of tension. It causes distortion, compaction, or breakage of components. Compression is most often used 
to reduce the strength of materials so that other methods can be used. 


Impact is the use of pressure and shock against a component. Striking and explosives are most common. 
Impact has a wide variety of results including fracturing, breakage, deformation, and compression. Some methods 
of bypass use impact to retract the locking bolt, most of which are destructive. Explosives are one of the most 
dangerous methods of destructive entry and use has dwindled with time as safer alternatives, such as drilling, have 


become popular. 


Shearing is the use of pressure on a component placed between two edges. Cutting, chopping, and drilling 
are included in this category. Drilling is the most popular method of destructive safecracking and removal of locks 
by a locksmith. In general, drilling is probably the easiest, fastest method of destructive entry. 


Extreme temperature can be used to affect the molecular structure of components. High temperatures can 
vaporize, burn, melt, or re-temper components. Re-tempering can leave components soft or brittle, thus vulnerable 
to many other attacks. Low temperatures are less common, but can be used for similar purposes. 


Tension is the use of pressure on a component 1n opposite directions. Stretching, pulling, prying, bending, 
or ripping are included in this category. 


Torsion is the use of rotational pressure (torque) on a component. Twisting and torque and included 1n this 
category. Causes shearing, compression, and deformation of components. 


Destructive entry is fairly straightforward in terms of method of entry, so the focus is on tool mark identification. 
The forensic locksmith must be wary of destructive techniques used as a method of hiding covert or surreptitious 
entry. A thorough investigation will reveal covert techniques and can potentially rule out destructive entry as the 
method of entry due to improbable direction, angle, or position of tool marks. 


Forensic Evidence 


The most common attack against padlocks is cutting the shackle, either in half or clean 
off. Almost all low to medium security non-shrouded padlocks are susceptible to this 
attack. This attack is a form of shearing, and the two edges of the bolt cutter are clearly 
seen in the displacement of the shackle material. 





A closer examination of the tool mark reveals that a red substance is present in the area a) fn 
where the bolt cutter was used. This could be a variety of things; paint, dirt, grease, or R; 
rust. We might be able to match this material to the tool 1f a bolt cutter is found in a 
suspect's possessions. 






Drilling, a form of shearing, is the most common method of destructive entry against 
all types of locks. It 1s frequently used by locksmiths to remove locks when they cannot 
be opened non-destructively. In this photo, the plug of a KIK cylinder has been drilled 
at the shear line, allowing the plug to freely rotate. 


On the Forensic Investigation page we discuss the need to tape any openings in locks 
recovered at the crime scene. In the photo, a large amount of metal 1s present inside the 
lock, a product of drilling. This material is preserved because it may contain evidence 
useful to the investigation, such as shards of a broken drill bit. 





Drills are much like firearms 1n terms of forensic evidence. Bullets fired from a gun 
have striae based on the barrel used; the same goes for drill bits used in destructive 

| m | entry. In the photo, the spiral striae left by the drill bit can clearly be seen in the plug of 
7 ia ee the lock. 





Impact is a versatile method of destructive entry that is extremely effective against 
windows, doors, and walls. In the photo, a padlock has been hammered until the 
shackle broke. The direction of the break can tell us what angle it was being struck 
from. Additional tool marks will likely be found on the body of the padlock. 


In this photo, the body of the padlock shows tool marks in places where the hammer 
impacted the lock. The crescent shaped marks are numerous and can be measured to 
determine the size and shape of the hammer used. At least three different points of 
impact are visible. 





Heavy damage to the face or keyway of the lock can mean many things. A thorough 

investigation of tool marks, including angles and positions, helps to reveal how entry 

was accomplished. In this photo the keyway has been considerably widened and 
gouged so a tool can be inserted, probably a screwdriver or chisel. 





In addition to damage to the keyway, the upper pin chambers have been completely 
sheared off, leaving the plug and broken cylinder free to rotate in the lock. This attack 
appears to be torsion applied counter-clockwise to the plug through the use of a 
screwdriver. 





The pins inside this lock show heavy damage from where the screwdriver or chisel was 
forced into the keyway. Examination of what 1s left of the tip of the pin shows no 
indication of covert entry techniques. Because of the force used, tool marks on the pins 
are rather distinct and may later be used to link suspects to the crime. 





European profile cylinders are held in place by a screw that extends through the center 
of the cylinder. Because the cam is beneath this point, it is the thinnest part of the lock 
and thus the easiest to break. In this photo, a european profile cylinder has been 
snapped in half (forced to the left) using common hand tools. 





The basis of this attack is that there is enough of the cylinder extending through the 
door, as little as a few millimeters, and a tool used to grab and apply force to the lock. 
In this photo, tool marks can be seen where the tool was used to grab the front of the 
lock. 


The cam of the lock can also be examined to determine which way the lock was 
snapped. This is generally not important, but the lock may have been snapped at an 
angle that is impossible when the door 1s closed, indicating fraud or misdirection from 
the real method of entry. 












Many destructive attacks against low security padlocks break the shackle because, 
relative to the body, it is the weakest component. In this photo, the padlock shackle is 
broken 1n two places, with one piece being stuck beneath the locking bolt. 


> yi) 9 A thorough examination of both the shackle and the padlock body helps to identify the 
b 8 |i! specific technique used. In this photo, the body of the padlock shows excessive 
distortion in the form of twisting, indicative of extreme torsion being applied to the 
| padlock body. 


aH ©) Tool marks for the torsion tool are found on the edges of the padlock. Marks appear to 
92) be rather fresh, thus the most likely candidates for the attack in question. 





‘wf A closer inspection of the tool mark shows a series of parallel teeth marks, probably 
| from the use of a plumber's wrench or tongue-and-groove pliers. Marks can be used in 
fee | tool mark comparisons done with tools found in a suspect's possessions. 





Simulating lockpicking is common in insurance fraud or when the insurance holder 1s 
worried about coverage. These people rarely understand lockpicking and just jam a 
screwdriver in the lock to make marks. In most cases, material removal and tool marks 
are present at the front of the cylinder but not past the first or second pin. 





The pins in simulated lockpicking will have a large amount of material removal and 
tool marks that are not consistent with any type of covert entry, including lockpicking 
or key bumping. Marks will usually not be found on the pins in the back of the lock, 


too. 





Chemicals are powerful because they can fundamentally alter metals to leave them 
vulnerable to many other attacks. In this case, brass pins are dark red/brown because of 
NO, fumes released when concentrated nitric acid contacted the brass components. 


Nitric acid has the effect of eating away the copper in brass. 





A closer examination can confirm the use of nitric acid by identifying trace evidence 
left by the chemical reaction between nitric acid and brass. The scattered blue particles 
are cupric nitrate and zinc nitrate, a byproduct of the chemical reaction. 





Forensic examination of lockpick toolmarks 


In almost all cases of lockpicking two tools are used. A tension tool is used to gently apply tension to the 
lock, and a pick is used to position components. As tension is applied to the plug, bolt, or other component, locking 
components will bind in some way. The pick can be used to determine which component 1s binding and then used 
to position it properly. The correct position of a component is known by the attacker through feedback in the form 
of touch, sound, or sight. The tension tool holds properly positioned components in place, and the attacker repeats 
the process. Once all components are properly positioned the lock can be unlocked or locked. 


The nature of lockpicking necessitates that strong materials be used for tension and picking tools. Tools are 
commonly made out of steel, 1ron, and aluminum. Tools are thin (on average 0.025 with pin-tumbler picks) and 


require a medium amount of force to move locking components. When contacting the softer brass or nickel-silver 
of locking components, pick and tension tools leave marks in the form of gouges and scratches. The best source of 
forensic evidence of lockpicking are on the components themselves, but the lock housing, bolt, and cam may also 
be examined, depending on the type of lock. 


Forensic Evidence 


The act of using a pick tool 1s invasive, and we expect the stronger material of the pick 
tool to cause marks on the softer brass or nickel-silver of the lock components. In this 
photo, we see scratches where the pick tool was used to lift the pin. These appear to be 
single-pin picking marks due to their shape and consistency. 


This photo is similar to the last, but instead there are many varied, elongated scratches 
at different angles and depths on the pin. This type of marking 1s indicative of a pick 
that is designed to be gently rubbed against the pins at varying height and tension. Of 
course, this is the technique known as raking or rake picking. 


In this photo, marks left appear to be a combination of both picking techniques. Many 
attackers will attempt to lightly rake as many pins as possible and then proceed to use 
single-pin picking against the rest. This may be necessary 1n the case of security pins 
that are triggered while raking, also. 


The marks left by an attacker are in many ways indicative of their skill level. In this 
photo, extremely deep and plentiful pick marks are shown. The attacker, an amateur, 
used extreme force on both tension and pick tools. The extreme tension causes pins to 
bind against plug and require more force to be lifted. 


This is a very skilled attacker who uses extremely light tension and picking force to 
reduce forensic evidence. Despite skill, we still find similar forensic evidence. In this 
photo, pick marks are extremely light but still visible in the center of the pin. We can 
also see some marks on the side of the pin which are more defined. 


There are many other designs of pin-tumbler besides the standard round or pointed tips. 
This is a photo of a Mul-T-Lock telescoping pin tumbler that uses an inner and outer 
pin stack. Both show signs of picking tools. If we separate the pins, we would also 
probably find picking marks on the inside chamber of the outer pin. 


Some pin tumbler designs are rather strange, designed to deter manipulation. This 
photo shows a Vachette VIP "nippled" pin. The design of this pin is rather complex, 
with not only a nippled tip but also a very spool like appearance. In any event, picking 
marks are visible along the nipple and base of the pin. 


Forensic evidence is also left behind by various lock-specific tools, which are growing 
more common with high-security locks. In this photo, the pick marks from a 
Medecoder type tool are visible in the sidebar channel where the tool was used to rotate 
the bottom pin. 





For the attacker, it is difficult to not touch the sides of pins. This can happen during 

“| raking as well as single-pin picking. Marks left on the sides of pins are quite noticeable 
| and not as prone to wear and those in the center of the pin. In the photo, light scratches 
ae a ‘| at varied angles are visible. 


_ ©) | In the case of low-high pinning combinations it is even harder to lift pins without 

» | touching the sides of other pins. In this photo, a series of long scratches travel up the 
WH) side of the pin. Interestingly, we may be able to measure the length of scratches to 
determine if the attacker raised the adjacent pin high enough. 


Like the bottoms of the pins, the sides can tell a great deal about the skill level of the 
attacker. In this photo, gouges on the sides of the keys are rather deep, caused by 
extreme force being used on both the tension and picking tools. With this much 
material removed, it may be possible to identify pin material on a suspect's possessions. 


(The movement of the pick through the keyway also leaves 
forensic evidence in several places. The most common ison -*. ~ 
the walls of the plug itself. In this photo, scratches left by the | = 
pick tool are found below the pin chambers on the walls of [== 

the plug. The scratches are at various angles inconsistent 
with the use of a key. 





One of the best places to look in the plug is at the top of the 
keyway. The key will never touch this area, so it is one of the 
few "virgin" areas in the lock. In this photo, we can see that 
there are light scratches along the area before the first 
chamber, probably from the use of a tension tool at the top of 
the keyway. 





Marks on the warding inside of the plug are also common. 
Normal use of keys does not usually cause these marks, but 
if they are indeed the cause marks should be present on 
several other wards, as well. In this photo, a deep gouge has 
been made by the pick tool on one of the wards deep inside 
the plug. 


Marks may also be left in the pin chambers themselves. In 
this photo, we see a mark on the left side of the pin chamber. 
This area of the plug cannot be touched by the key and pins 
would not make a mark like this unless they were severely 
deformed. Compare with the chamber wall on the right. 


We might find pick marks higher in the pin chambers, too. 
These areas are subject to wear as pin stacks are moved by 
the normal action of the key. In this photo, an up-down-up 
patterned scratch is seen. This is probably caused by the 
attacker lifting and lowering the pin stack, trying to find the 





shear-line. 


Forensic evidence of the tension tool can also be identified 
rather easily, especially if the attacker is a beginner or 
amateur lockpicker. The act of putting tension on the plug 
causes the tool to lightly shear the plug walls. In this photo, 
we can see the gouges left by the tension tool being placed at 
the bottom of the keyway. 





Destructive disassembly of the plug lets us get a better 
picture of tension tool marks. In this photo, we can see that 
there is a deep gouge where the tension tool was actually 
used, as well as several scratches below it. The scratches are 
likely from positioning of the tool or tapping it with the 
picking tool while picking. 





In the case of a skilled attacker, very light torque is applied 
to the tension tool. It may be more complicated to identify 
marks without proper lighting, but even in this example, 
where low tension was used, the tension tool marks can be 
identified when they are properly illuminated. 





©9743) The cam may also have marks because many attackers, when navigating the back of the 
plug, will hit the cam. This is especially true of less controlled techniques like raking. 

| In the photo, a light scratch is present in the center of the cam, a place the key normally 
| does not touch. 


| One of the problems as an amateur 1s knowing where the pick is. It is common to see 

co =| many amateurs with the tip of the pick poking out of the cylinder. When the cam is on, 
<i) this may translate into extreme scratching on the back of the cam, as seen in this photo. 
. Similar marks may be left by some forms of bypass. 


Effects of wear 





The question always arises as to how we can determine when pick marks were made or 
how long it takes normal wear to remove them. In this photo 1s the first pin from a lock 
that has been picked once. We will use this as a reference to see the effects of wear 
after 250 uses. 





After 250 uses (roughly 2-4 months use) the tip of the pin has been worn by the key, 
leaving fewer distinct picking marks. At the same time, the sides of the pin still show 
very clear and distinct picking marks. This is because the key does not touch these 
areas as frequently and may never, depending on the key bitting. 


While taking the last photo I noticed a strange shape in the top right of the photo. When 
I refocused in that area I found this. It appears to be a small piece of brass that has 
transferred to the tip of the pin, probably a very small fragment of the key. Quick, call 
the crime lab! 





Non-metal Lockpicks 


| Carbon fiber lockpicks were considered for use in Anti-Forensics, but my research 
shows that they leave marks similar to traditional metal lockpicking tools. The photo 

| shows a finished carbon fiber lockpick in the half-diamond design. This pick is roughly 
0.025" thick. 


Carbon fiber picks did not work as well as I had hoped. Most importantly they fell short 
of surreptitious by leaving marks on pin-tumblers similar to traditional tools. In this 

| photo, light scratching along the tip and side of the pin can be seen, caused by a carbon 

| fiber lockpicking tool. 





Carbon fiber lockpicks also seem to grab and hold pin materials much better than their 
metal counterparts. In the photo, a carbon fiber pick is shown with brass residue from 

the pins of a lock it has picked. This can be used in court as evidence to link a suspect 

to a crime. 





Also considered for Anti-Forensics were fiberglass based lockpicking tools. My 
research shows that these are also unsuitable because they leave distinct forensic 
evidence on the pins and inside the plug. In this photo, a half-diamond fiber glass pick 
is shown. This pick is roughly 0.028" thick. 





Fiberglass also left various traces similar to traditional metal lockpicking tools. In this 
photo, parallel scratches at various angles and positions can be seen on the bottom and 
side of the pin-tumbler. All marks were cause by the fiberglass picking tool. 





Fiberglass is also less surreptitious than carbon fiber because the act of picking and 
raking the lock leaves behind a sizable amount of fiberglass on the pin-tumblers and 
walls of the plug. In this photo, fiberglass residue can be seen on the tip of the pin- 
tumbler. 


Like carbon fiber picks, fiberglass does a very good job of trapping trace evidence 
from the pin-tumbler inside the lock onto the pick. In this photo, the tip of the 
fiberglass pick is shown with light brass residue and lubricant (black) clearly visible. 





Thank you for reading our ninth edition 


Visit Resist.com to buy future and archived editions. 


Sure you can trust the government, just ask an Indian! 
We work with a separate organization that allows us to maintain our privacy and acts as a cashier for sales and 
donations. Please refer to THE PARANOID NEWSLETTER in all your correspondence, otherwise the staff 
will confuse your correspondence with another newsletter. Send email to TM Metzger@yahoo.com (Note the 
‘* ” character is not a space) or send us snail mail with your donation and request for additional newsletters to: 

Tom Metzger 

P.O. Box 401 

Warsaw, In 46581 


